Nick SzaunigandClaude Opus 5.5
a7609ff3f8
Security review finding (client-side path traversal): ids taken from the URL were interpolated into API paths unencoded, so a crafted link like /raw-materials/..%2Fusers made the page call another endpoint with the viewer's token. Ids are now encodeURIComponent-ed; a regression test pins "../users" to its own path segment. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>